{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5db41d8e-f8e8-513e-87d2-eb23b1eb95cf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4", "version": "5.5.8-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.8", "type": "library", "group": "org.springframework.security", "version": "5.5.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4" } ], "bom-ref": "urn:uuid:919126aa-6c29-5f46-8f79-84e0ab2c8e4b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22112 does not affect version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-web. The target repository (Spring Security 5.5.8) is NOT AFFECTED by CVE-2021-22112. The upstream fix (commit 3116369f027 by Rob Winch, January 22, 2021) was already present in the Spring Security 5.5.8 release when TuxCare onboarded it (commit 8cf3277976, October 2026). The vulnerable guard pattern `if (!responseWrapper.isContextSaved())` that prevented multiple SecurityContext saves has been removed, and the fix's tracking mechanism (`isSaveContextInvoked` flag) is properly implemented in the target code. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4" } ], "bom-ref": "urn:uuid:3096c54c-74d4-5188-86b3-b9775f4ef4fb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22978 does not affect version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-web. CVE-2022-22978 affects Spring Security versions 5.5.6, 5.5.7, and older versions where RegexRequestMatcher with `.` in regex patterns could be bypassed using line terminators (\\n, \\r). The target version 5.5.8 is NOT affected because the upstream fix (commit c6461d61babfcf92febfd0a85785623e53190a8f) was already included in the upstream Spring Security 5.5.8 release before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0) is not present; the code correctly uses Pattern.DOTALL to ensure `.` matches line terminators in authorization regex patterns.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4" } ], "bom-ref": "urn:uuid:c947ad28-cd8d-5ab4-a7b8-0bbb826510a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4" } ], "bom-ref": "urn:uuid:5e431fdb-ddee-52c6-81a0-b969127d17a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4" } ], "bom-ref": "urn:uuid:da9e195c-4b1e-5a24-9b31-5c5e6c242783", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4" } ], "bom-ref": "urn:uuid:648ea802-5160-5972-9689-ca866eae6960", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-web. Spring Security 5.5.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher.Builder (Spring Security 7.0.0-7.0.4) where a builder pattern bug prevents the basePath from being configured, causing servlet-path-aware authorization rules to be bypassed. Version 5.5.8 uses a different architecture (MvcRequestMatcher) that correctly handles servlet-path configuration through direct property assignment rather than a builder pattern, and therefore does not contain the vulnerable code path.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4" } ], "bom-ref": "urn:uuid:db91eda8-d7eb-57ad-b041-90f88c4f078d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4" } ], "bom-ref": "urn:uuid:4230d435-71fc-58da-be9e-201d759c3a8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4" } ], "bom-ref": "urn:uuid:8b9467c3-e450-56eb-ae45-a406deacb0c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.5.8 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.5.8-tuxcare.4" } ] }